As more and more computers and other computing devices are interconnected through various networks such as the Internet, computer security has become increasingly more important, particularly from invasions or attacks delivered over a network or over an information stream. As those skilled in the art will recognize, these attacks come in many different forms including, but certainly not limited to, computer viruses, computer worms, system component replacements, denial of service attacks, even misuse/abuse of legitimate computer system features—all of which exploit one or more computer system vulnerabilities for illegitimate purposes. While those skilled in the art will realize that the various computer attacks are technically distinct from one another, for purposes of the present invention and for simplicity in description, all malicious computer programs will be generally referred to hereinafter as computer malware, or more simply, malware.
When a computer is attacked or “infected” by computer malware, the adverse results are varied, including disabling system devices; erasing or corrupting firmware, applications, or data files; transmitting potentially sensitive data to another location on the network; shutting down the computer; or causing the computer to crash. Yet another pernicious aspect of many, though not all, computer malware is that an infected computer is used to infect other systems.
FIG. 1 is a pictorial diagram illustrating an exemplary networking environment 100 over which a computer malware is commonly distributed. As shown in FIG. 1, the typical exemplary networking environment 100 includes a plurality of computers 102-108. all inter-connected via a communication network 110, such as an intranet or via a larger communication network including the global TCP/IP network commonly referred to as the Internet. For whatever reason, a malicious party on a computer connected to the network 110, such as computer 102, develops a computer malware 112 and releases it on the network. The released computer malware 112 is received by and infects one or more computers, such as computer 104 as indicated by arrow 114. As is typical with many computer malware, once infected, computer 104 is used to infect other computers, such as computer 106 as indicated by arrow 116 that, in turn, infects yet other computers, such as computer 108 as indicated by arrow 118. It should be appreciated that the malware 112 may be directed to any one of the computers 104-108 as a result of a request initiated by the computer 102. Clearly, due to the speed and reach of the modern computer networks, a computer malware 112 can “grow” at an exponential rate and quickly disrupt communications between organizations and people.
A traditional defense against computer malware, and particularly computer viruses and worms, is antivirus software. Generally described, antivirus software scans data, looking for identifiable patterns associated with known computer malware. Frequently this is done by matching patterns within the data to what is referred to as a “signature” of the malware. If a malware signature is identified, the antivirus software takes appropriate action, such as deleting the malware/infected file or removing the malware from an infected file. One of the core deficiencies in this malware detection model is that some malware may employ certain techniques to avoid being scanned for malware. Thus, computers remain susceptible to malware, even if antivirus software is installed on the computer. For example, a malware may use mechanisms available from an operating system to “lock” a file or otherwise restrict the ability of other programs executing on the computer to access data in the file. In this instance, data in a file may not be scanned for antivirus software before being “executed” on the computer.
Sadly, when a computer is exposed to the effects of malware, the infected computer costs the computer's owner substantial amounts of money to “disinfect” and repair. This cost can be enormous when dealing with large corporations or entities that may have thousands or hundreds of thousands of devices attached to a network. Such a cost is further amplified by the possibility that the malware may tamper with or destroy user data, which may be extremely difficult or impossible to remedy.